CN115242545A - Safety management method and system for Internet of things equipment data - Google Patents

Abstract

The invention relates to the field of information data safety, and discloses a safety management method and a system for Internet of things equipment data, which can protect the information data safety of intelligent household equipment, can effectively avoid link control and data stealing behaviors of unauthorized equipment on an intelligent household, and can effectively avoid the data safety problem when a single piece of equipment is invaded and cracked by a mutual assistance encryption authentication mode among multiple pieces of Internet of things equipment in the application compared with a simple identity verification method adopted by the existing intelligent household Internet of things equipment, so that the safety of the whole intelligent household Internet of things equipment group is improved.

Description

A security management method and system for IoT device data

technical field

The invention relates to the related field of information data security, in particular to a security management method and system for Internet of Things device data.

Background technique

With the rapid development of computer technology, IoT smart homes are gradually being widely used in more and more young families. Higher intelligence and automation can bring greater convenience to life and improve daily life to a certain extent. Happiness in home life.

But at the same time, because of its networking function and intelligence, smart home devices also pose more hidden dangers to the security of home information equipment. The increase in the number of home network interfaces makes it more convenient for unauthorized personnel to invade the home network. More The interface means more breakthroughs, which seriously affects the security of home information and network.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a security management method and system for IoT device data, so as to solve the problems raised in the above background technology.

To achieve the above object, the present invention provides the following technical solutions:

A security management system for IoT device data, including:

The data response module is used to obtain the request verification data, randomly encrypt the request verification data multiple times through a preset multi-encryption program, generate multi-dimensional encrypted data and forward it, the multi-encryption program includes multiple sets of encryption schemes, the The encryption scheme corresponds to different IoT terminals, and the multi-dimensional encrypted data is provided with an encryption scheme identification bit;

The data mutual recognition module is used to receive multi-dimensional encrypted data, and judge the highest bit of the encryption scheme identification bits based on its own preset identification code. If it matches, and the total number of encryption scheme identification bits is greater than one, according to the predetermined The set encryption scheme decrypts and forwards the multi-dimensional encrypted data, and if the total number of identification bits of the encryption scheme is one, then guide the execution of the information identification program;

An information identification module for executing the information identification program, including the steps of: identifying the multi-dimensional encrypted data based on a preset data identification library, making a security judgment on the multi-dimensional encrypted data, generating a request verification judgment result and forwarding it , the request verification result is provided with a receiving identification bit, and the data identification library is a basic character database that is deciphered by the encryption scheme;

The request-response module is configured to judge the identification bit through the identification code preset by itself to receive the request-verification judgment result, respond to the request-verification judgment result, and acquire and respond to the data corresponding to the request verification. Corresponding device control requests and data read and write requests.

As a further scheme of the present invention: it also includes a collaborative authentication module, and the collaborative authentication module includes:

The identity authentication unit is used to obtain the object access request, obtain the object identity information in the object access request, and establish request verification data according to the object identity information, and the request verification data is used to perform the verification on the object identity information. requesting authentication, the object identity information includes biometric information;

The device authentication unit is used to obtain the Internet of Things terminal access request, obtain the terminal identity information in the terminal access request and verify it, if the verification is passed, request to obtain the biometric identification information of the operation object, and based on the biometric identification The message build requests authentication data to authenticate the operator.

As a further scheme of the present invention: the request response module includes an information identification unit;

The information identification unit is configured to obtain the device control request and the data read/write request, and identify and respond to the device control request and the data read/write request through a preset command response library. If the device control request and the data read/write request exceed the preset instruction response library, stop responding to the device control request and the data read/write request and request to obtain the biometric identification information of the operating object. The biometric identification information creates request verification data to authenticate the operator.

As a further scheme of the present invention: also includes a state synchronization module;

The state synchronization module is used for judging the connection states of a plurality of the Internet of Things terminals, and marking a plurality of groups of the encryption schemes based on the connection states, and the marking is used to mark the connection state as offline The encryption scheme corresponding to the IoT terminal is invalid.

As a further solution of the present invention: both the data mutual recognition module and the data identification module are provided with a response marking unit, and the response marking unit is used to mark the response to the request verification judgment result according to the identification code, When responding to the request verification judgment result, judge the response flag according to the encryption scheme identification bit, and respond to the request verification judgment result if it matches.

The embodiment of the present invention aims to provide a security management method for IoT device data, comprising the steps of:

Obtain the request verification data, perform random encryption on the request verification data multiple times through a preset multiple encryption program, generate multidimensional encrypted data and forward it, and the multiple encryption program includes multiple sets of encryption schemes, and the encryption schemes are different from different objects. Corresponding to the network terminal, the multi-dimensional encrypted data is provided with an encryption scheme identification bit;

Receive multi-dimensional encrypted data, and judge the highest bit of the encryption scheme identification bits based on its own preset identification code, if it matches, and the total number of encryption scheme identification bits is greater than one, according to the preset encryption scheme. The multi-dimensional encrypted data is decrypted and forwarded, and if the total number of identification bits of the encryption scheme is one, the information identification program is guided to be executed;

The information identification program includes the steps of: identifying the multi-dimensional encrypted data based on a preset data identification library, making a security judgment on the multi-dimensional encrypted data, generating and forwarding a request verification judgment result, and the request verification result is set. There is a receiving identification bit, and the data identification library is a basic character database that is deciphered by the encryption scheme;

The identification bit is judged by the identification code preset by itself to receive the request verification judgment result, respond to the request verification judgment result, obtain and respond to the device control request corresponding to the request verification data, and Data read and write requests.

As a further scheme of the present invention: also comprise steps:

Obtain an object access request, obtain the object identity information in the object access request, and establish request verification data according to the object identity information, and the request verification data is used to perform request authentication on the object identity information, and the object Identity information includes biometric information;

Obtain the Internet of Things terminal access request, obtain the terminal identity information in the terminal access request and verify, if the verification is passed, request to obtain the biometric identification information of the operation object, and create request verification data based on the biometric identification information to Authenticate the operator.

As a further scheme of the present invention: the steps of obtaining and responding to the device control request and the data read/write request corresponding to the request verification data specifically include:

Obtain the device control request and the data read/write request, identify and respond to the device control request and the data read/write request through a preset command response library, if the device control request and the data read/write request If the write request exceeds the preset instruction response library, the response to the device control request and the data read/write request is stopped, and the biometric identification information of the operation object is requested to be obtained, and a request verification is established based on the biometric identification information. data to authenticate the operator.

Compared with the prior art, the beneficial effects of the present invention are: it can protect the information and data security of the smart home equipment, and can effectively avoid the link control and data theft of the smart home by unauthorized equipment. The simple authentication method adopted by the existing smart home IoT devices, in this application, the mutual assistance encryption authentication method among multiple IoT devices can effectively avoid the data security problem when a single device is intruded and cracked, and improve the overall intelligence Security of home IoT device fleets.

Description of drawings

Figure 1 is a block diagram of a security management system for IoT device data.

FIG. 2 is a block diagram of a collaborative authentication module in a security management system for IoT device data.

FIG. 3 is a flowchart of a method for security management of IoT device data.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

As shown in FIG. 1, an embodiment of the present invention provides a security management system for IoT device data, including:

The data response module 100 is configured to obtain request verification data, perform random encryption on the request verification data multiple times through a preset multi-encryption program, generate multi-dimensional encrypted data and forward it, and the multi-encryption program includes multiple sets of encryption schemes, so The encryption scheme corresponds to different IoT terminals, and the multi-dimensional encrypted data is provided with an encryption scheme identification bit.

The data mutual recognition module 300 is used for receiving multi-dimensional encrypted data, and judges the highest bit of the encryption scheme identification bits based on its own preset identification code, if it matches, and the total number of the encryption scheme identification bits is greater than one, according to The preset encryption scheme decrypts and forwards the multi-dimensional encrypted data, and if the total number of identification bits of the encryption scheme is one, the information identification program is guided to be executed.

The information identification module 500, configured to execute the information identification program, includes the steps of: identifying the multi-dimensional encrypted data based on a preset data identification library, making a security judgment on the multi-dimensional encrypted data, generating a request verification judgment result and Forwarding, the request verification result is provided with a receiving identification bit, and the data identification library is a basic character database that is decoded through the encryption scheme.

The request response module 700 is configured to judge the identification bit through the identification code preset by itself to receive the request verification judgment result, respond to the request verification judgment result, obtain and respond to the request verification data Corresponding device control requests and data read and write requests.

In this embodiment, a security management system for IoT device data is disclosed, which is suitable for the IoT network system of smart home, can protect the information and data security of smart home devices, and can effectively avoid unauthorized access Compared with the simple authentication method adopted by the existing smart home IoT devices for the link control of the device to the smart home and the data theft, the method of mutual assistance encryption authentication between multiple IoT devices in this application can be effective. To avoid data security problems when a single device is intruded and cracked, and improve the security of the overall smart home IoT device group; specifically, when the user or unauthorized personnel connect to any of the smart home devices through the wireless network, the generated The data content of the request verification or the data verification that is trying to connect will be randomly encrypted by the data response module 100 for many times, and each random encryption corresponds to a set of encryption schemes, corresponding to other different smart home devices. (ie IoT devices), and then forward the encrypted data. The data mutual recognition module 300 of other smart homes will release the encryption of the outermost layer of the encrypted data when the encryption scheme is consistent with itself. When the number of encryption layers is one, it will Use its own data identification library to identify the encrypted content, so as to make the requested identity or security judgment (the data identification library here is deterministic and unique for each smart home), and after the final verification is passed, the verification result will be returned. The smart home that accepts the request responds to the corresponding request content through the request response module 700. At the same time, such a multi-device collaborative authentication method can also transmit danger signals through other devices when a certain device is invaded to notify the use of By.

As shown in FIG. 2, as another preferred embodiment of the present invention, it further includes a collaborative authentication module, and the collaborative authentication module 900 includes:

An identity authentication unit 901, configured to acquire an object access request, acquire object identity information in the object access request, and establish request verification data according to the object identity information, and the request verification data is used to verify the object identity information A request for authentication is performed, and the object identity information includes biometric information.

The device authentication unit 902 is configured to obtain an Internet of Things terminal access request, obtain and verify the terminal identity information in the terminal access request, and if the verification is passed, request to obtain the biometric identification information of the operating object, and based on the biometrics The identification information establishes request authentication data to authenticate the operator.

In this embodiment, a collaborative authentication module 900 and related function division descriptions are added, wherein the identity authentication unit 901 is a unit that performs identity authentication on other devices connected to smart home devices, and accesses the data response module 100 by connecting the object access request to the data response module 100. Then perform mutual encryption authentication between multiple devices to determine the identity of the object, so that the identity data packets in the process of verifying the identity of the object are in an encrypted state. The package (the data segment containing the object's identity information), also because it is encrypted, cannot be used for identity authentication during intrusion. After the connection is opened, the actual authentication operation of the owner is required to rejoin the network group, which further reduces the probability of intrusion by repeatedly disconnecting the device and requesting packet capture.

As another preferred embodiment of the present invention, the request response module 700 includes an information identification unit;

The information identification unit is configured to obtain the device control request and the data read/write request, and identify and respond to the device control request and the data read/write request through a preset command response library. If the device control request and the data read/write request exceed the preset instruction response library, stop responding to the device control request and the data read/write request and request to obtain the biometric identification information of the operating object. The biometric identification information creates request verification data to authenticate the operator.

In this embodiment, the information identification unit is a step used to identify the instructions received by the IoT device, and the instruction response library is a secure executable instruction established by the user. When ordering, authentication is required to confirm the identity.

As another preferred embodiment of the present invention, it also includes a state synchronization module;

The state synchronization module is used for judging the connection states of a plurality of the Internet of Things terminals, and marking a plurality of groups of the encryption schemes based on the connection states, and the marking is used to mark the connection state as offline The encryption scheme corresponding to the IoT terminal is invalid.

Further, both the data mutual recognition module 300 and the data identification module 500 are provided with a response marking unit, and the response marking unit is used to mark the response to the request verification judgment result according to the identification code. When responding to the request verification judgment result, judge the response flag according to the encryption scheme identification bit, and respond to the request verification judgment result if it matches.

In this embodiment, the role of the state synchronization module is to avoid the problem that when a certain smart home is offline, other devices are still encrypted based on the encryption scheme of the device, resulting in the failure of verification; the response marking unit is used to decrypt the multi-dimensional encrypted data and The process of identification is marked to facilitate verification to identify cases of hijacking by other devices rather than normal decryption.

As shown in FIG. 3 , the present invention also provides a security management method for IoT device data, which includes:

S200: Obtain request verification data, perform random encryption on the request verification data multiple times through a preset multiple encryption program, generate multidimensional encrypted data and forward it, the multiple encryption program includes multiple sets of encryption schemes, and the encryption schemes are different from Corresponding to the Internet of Things terminal, the multi-dimensional encrypted data is provided with an encryption scheme identification bit.

S400: Receive multi-dimensional encrypted data, and judge the highest bit of the encryption scheme identification bits based on a preset identification code of the encryption scheme. The multi-dimensional encrypted data is decrypted and forwarded, and if the total number of identification bits of the encryption scheme is one, the information identification program is guided to be executed.

S600, the information identification program includes the steps of: identifying the multi-dimensional encrypted data based on a preset data identification library, making a security judgment on the multi-dimensional encrypted data, generating and forwarding a request verification judgment result, and the request verification result Provided with a receiving identification bit, the data identification library is a basic character database deciphered by the encryption scheme.

S800, judge the identification bit by using the identification code preset by itself to receive the request verification judgment result, respond to the request verification judgment result, and obtain and respond to the device control corresponding to the request verification data requests and data read and write requests.

As another preferred embodiment of the present invention, it also includes the steps:

Obtain an object access request, obtain the object identity information in the object access request, and establish request verification data according to the object identity information, and the request verification data is used to perform request authentication on the object identity information, and the object Identity information includes biometric information.

Obtain the Internet of Things terminal access request, obtain the terminal identity information in the terminal access request and verify, if the verification is passed, request to obtain the biometric identification information of the operation object, and create request verification data based on the biometric identification information to Authenticate the operator.

As another preferred embodiment of the present invention, the step of acquiring and responding to the device control request and the data read/write request corresponding to the request verification data specifically includes:

Obtain the device control request and the data read/write request, identify and respond to the device control request and the data read/write request through a preset command response library, if the device control request and the data read/write request If the write request exceeds the preset instruction response library, the response to the device control request and the data read/write request is stopped, and the biometric identification information of the operation object is requested to be obtained, and a request verification is established based on the biometric identification information. data to authenticate the operator.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium , when the program is executed, it may include the flow of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other medium used in the various embodiments provided in this application may include non-volatile and/or volatile memory. Nonvolatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Road (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

Other embodiments of the present disclosure will readily occur to those skilled in the art upon consideration of the disclosure at the specification and examples. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or techniques in the technical field not disclosed by the present disclosure . The specification and examples are to be regarded as exemplary only, with the true scope and spirit of the disclosure being indicated by the claims.

It is to be understood that the present disclosure is not limited to the precise structures described above and illustrated in the accompanying drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims (8)

1. a security management system for Internet of Things device data, characterized in that, comprising: The data response module is used to obtain the request verification data, randomly encrypt the request verification data multiple times through a preset multi-encryption program, generate multi-dimensional encrypted data and forward it, the multi-encryption program includes multiple sets of encryption schemes, the The encryption scheme corresponds to different IoT terminals, and the multi-dimensional encrypted data is provided with an encryption scheme identification bit; The data mutual recognition module is used to receive multi-dimensional encrypted data, and judge the highest bit of the encryption scheme identification bits based on its own preset identification code. If it matches, and the total number of encryption scheme identification bits is greater than one, according to the predetermined The set encryption scheme decrypts and forwards the multi-dimensional encrypted data, and if the total number of identification bits of the encryption scheme is one, then guide the execution of the information identification program; An information identification module for executing the information identification program, including the steps of: identifying the multi-dimensional encrypted data based on a preset data identification library, making a security judgment on the multi-dimensional encrypted data, generating a request verification judgment result and forwarding it , the request verification result is provided with a receiving identification bit, and the data identification library is a basic character database that is deciphered by the encryption scheme; The request-response module is configured to judge the identification bit through the identification code preset by itself to receive the request-verification judgment result, respond to the request-verification judgment result, and acquire and respond to the data corresponding to the request verification. Corresponding device control requests and data read and write requests. 2. The security management system for IoT device data according to claim 1, further comprising a collaborative authentication module, wherein the collaborative authentication module comprises: The identity authentication unit is used to obtain the object access request, obtain the object identity information in the object access request, and establish request verification data according to the object identity information, and the request verification data is used to perform the verification on the object identity information. requesting authentication, the object identity information includes biometric information; The device authentication unit is used to obtain the Internet of Things terminal access request, obtain the terminal identity information in the terminal access request and verify it, if the verification is passed, request to obtain the biometric identification information of the operation object, and based on the biometric identification The message build requests authentication data to authenticate the operator. 3. The security management system for IoT device data according to claim 2, wherein the request-response module comprises an information identification unit; The information identification unit is configured to obtain the device control request and the data read/write request, and identify and respond to the device control request and the data read/write request through a preset command response library. If the device control request and the data read/write request exceed the preset instruction response library, stop responding to the device control request and the data read/write request and request to obtain the biometric identification information of the operating object. The biometric identification information creates request verification data to authenticate the operator. 4. The security management system for IoT device data according to claim 1, further comprising a state synchronization module; The state synchronization module is used for judging the connection states of a plurality of the Internet of Things terminals, and marking a plurality of groups of the encryption schemes based on the connection states, and the marking is used to mark the connection state as offline The encryption scheme corresponding to the IoT terminal is invalid. 5. The security management system for IoT device data according to claim 4, wherein the data mutual recognition module and the data identification module are both provided with a response marking unit, and the response marking unit is used for The request verification judgment result is marked as a response according to the identification code. When responding to the request verification judgment result, the response mark is judged according to the encryption scheme identification bit, and if it matches, the request is responded to. Verify the judgment result. 6. A security management method for IoT device data, comprising the steps of: Obtain the request verification data, perform random encryption on the request verification data multiple times through a preset multiple encryption program, generate multidimensional encrypted data and forward it, and the multiple encryption program includes multiple sets of encryption schemes, and the encryption schemes are different from different objects. Corresponding to the network terminal, the multi-dimensional encrypted data is provided with an encryption scheme identification bit; Receive multi-dimensional encrypted data, and judge the highest bit of the encryption scheme identification bits based on its own preset identification code, if it matches, and the total number of encryption scheme identification bits is greater than one, according to the preset encryption scheme. The multi-dimensional encrypted data is decrypted and forwarded, and if the total number of identification bits of the encryption scheme is one, the information identification program is guided to be executed; The information identification program includes the steps of: identifying the multi-dimensional encrypted data based on a preset data identification library, making a security judgment on the multi-dimensional encrypted data, generating and forwarding a request verification judgment result, and the request verification result is set. There is a receiving identification bit, and the data identification library is a basic character database that is deciphered by the encryption scheme; The identification bit is judged by the identification code preset by itself to receive the request verification judgment result, respond to the request verification judgment result, obtain and respond to the device control request corresponding to the request verification data, and Data read and write requests. 7. The method for security management of IoT device data according to claim 6, further comprising the steps of: Obtain an object access request, obtain the object identity information in the object access request, and establish request verification data according to the object identity information, and the request verification data is used to perform request authentication on the object identity information, and the object Identity information includes biometric information; Obtain the Internet of Things terminal access request, obtain the terminal identity information in the terminal access request and verify, if the verification is passed, request to obtain the biometric identification information of the operation object, and create request verification data based on the biometric identification information to Authenticate the operator. 8. The method for security management of IoT device data according to claim 7, wherein the step of acquiring and responding to a device control request and a data read/write request corresponding to the request verification data specifically includes the following steps: : Obtain the device control request and the data read/write request, identify and respond to the device control request and the data read/write request through a preset command response library, if the device control request and the data read/write request If the write request exceeds the preset instruction response library, the response to the device control request and the data read/write request is stopped, and the biometric identification information of the operation object is requested to be obtained, and a request verification is established based on the biometric identification information. data to authenticate the operator.

Images